No material or high-risk item was identified.
Expected scanner matches (22)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that loads the project's own source file and runs pieces of it in isolation to verify behavior. Nothing from outside the project is being executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function(...)` call inside a test file. The function body is constructed from source code extracted by brace-counting from the project's own index.js, read locally via readFileSync. No external or untrusted input reaches the dynamic function constructor; the evaluated code is the project's own source. This is a common unit-testing technique for scripts that lack module exports.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:144
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that dynamically loads a function from the extension's source code to verify it works correctly with fake test data. No real user data or external systems are involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate is in a test file that uses new Function() to extract and unit-test the buildMoveSectionHtml function with a mock escapeHtml. The dynamic execution is confined to the test harness, operates on synthetic test data, and does not interact with external systems or user-supplied content.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:563
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that builds a small function from the extension's source to check it works correctly. It only runs locally during tests and does not touch any real data or services.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched dynamic execution is a `new Function` call inside a test harness that extracts a named function from the extension source and returns it for unit testing. The constructed function operates on local test fixtures and mocks; there is no network, credential, or persistence data flow. This is a standard test-isolation pattern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:446
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test loads one of the project's own functions and checks that a cache size limit works correctly. No outside data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A `new Function(...)` call in the test file constructs a function from the project's own extracted source (touchContentCache). The only inputs are a numeric constant parsed from the same local source file and synthetic test data. No untrusted data is evaluated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:207-210
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test loads the project's own pin-management functions and verifies per-character pin isolation. No outside data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A `new Function(...)` call in the test file constructs a function from the project's own extracted source (normalizeChatId, pinKey, isPinnedFile, togglePin). Inputs are synthetic test stubs and local state objects. No untrusted data is evaluated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:226-228
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test loads the project's own sorting function and checks that branch activity sorting works. No outside data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A `new Function(...)` call in the test file constructs a sort function from the project's own extracted source (sortChats). Inputs are synthetic test chat objects. No untrusted data is evaluated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:118
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test file creates a sandboxed version of a chat-moving function with fake network responses to verify it behaves safely. No real data or network activity is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate constructs a test harness using new Function() to unit-test moveChatToCharacter with a mocked fetch, SillyTavern, and toastr. The dynamic execution is used solely to isolate and test the function's pipeline ordering (read, write, delete) with controlled mock responses. No real network calls or credential access occurs.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:499-505
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test loads several of the project's own functions and checks them against a fake browser environment. No outside data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A `new Function(...)` call in the test file constructs an API object from the project's own extracted source (escapeHtml, highlightText, getActiveChatName, isActiveChatFile). Inputs are a JSDOM document stub and a SillyTavern API stub. No untrusted data is evaluated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:25-26
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test loads the project's own attribute-escaping function and checks that special characters are handled correctly. No outside data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A `new Function(...)` call in the test file constructs a function from the project's own extracted source (escAttr). Inputs are synthetic test strings. No untrusted data is evaluated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:249
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that wires up mocked versions of the extension's functions to verify activity-stamping behavior. It stays entirely within the test file.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function` constructs a test wrapper around several extracted extension functions, injecting mocked settings, character-id, and save callbacks. All dependencies are local test doubles; no external destinations or sensitive data are involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:294-296
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that checks how the extension resolves chat titles from the UI. It uses a fake DOM element and does not access real data.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function` builds a test-only title resolver from extracted source and invokes it on a synthetic DOM element. No sensitive data flow, network calls, or persistence are present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:435
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test that loads a menu-building function with fake data to check it produces the right options and escapes text properly. No real user data is used.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate uses new Function() to extract and test buildMoveSectionHtml with a mock escapeHtml function, verifying contextual menu items and HTML escaping. The dynamic execution is confined to the test file with synthetic inputs and no external interaction.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:547
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test loads the project's own activity-data builder and checks branch parentage extraction. No outside data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A `new Function(...)` call in the test file constructs a function from the project's own extracted source (buildActivityData). Inputs are synthetic test item arrays. No untrusted data is evaluated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:96
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test that loads a card-overview function with fake chat data to verify it sorts and labels things correctly. No real data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate uses new Function() to extract and unit-test buildCardsOverview with synthetic chat items, character, and group data. The test verifies ordering, name resolution, and filtering of malformed items. No external systems or untrusted input are involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:470
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that verifies how chats are grouped into branch families. It only uses sample names provided in the test.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function` constructs a test instance of the extension's family-clustering function and runs it against local chat-name fixtures. No external data flow or sensitive operations are involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:339
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that checks chat-id normalization and folder-move logic using mocked settings. It does not touch real chats or services.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function` builds a test wrapper around extracted chat-id normalization and move functions, injecting mocked settings and sync callbacks. All data flow is local to the test fixtures.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:374-376
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test that loads a time-formatting function with fixed timestamps to check it produces readable labels. No real data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate uses new Function() to extract and unit-test formatRelativeTime with fixed timestamp values. The dynamic execution is confined to the test file and verifies time formatting logic with no external interaction.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:569
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that verifies how branch lineages climb to their root chat. It uses a small fake parentage map and no real data.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function` constructs a test-only family-root resolver with a mocked branch-parent lookup. Execution is confined to local test data with no sensitive data flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:328
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test loads the project's own panel-visibility function and checks open and close transitions. No outside data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A `new Function(...)` call in the test file constructs a function from the project's own extracted source (syncPanelVisibility). Inputs are synthetic test stubs for DOM and state. No untrusted data is evaluated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:187-190
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test that loads a chat-adaptation function with fake message data to verify it renames things correctly without altering the original data. No real data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate uses new Function() to extract and unit-test adaptChatForTarget with synthetic chat message arrays. The test verifies header rewriting, name mapping, and input immutability. No external systems or untrusted input are involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:454
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that checks how the extension finds a branch's parent chat from metadata and filename patterns. It only uses sample data.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function` builds a test instance of the branch-parent resolver and runs it against local metadata fixtures. No network, credential, or persistence data flow is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:315
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that checks how the extension refreshes activity data and avoids duplicate fetches. It uses a fake fetch that never actually contacts a server.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function` constructs a test wrapper around the extension's activity-refresh function, injecting a mocked fetch that returns a pending promise and local TTL constants. The test verifies branch-map reset and TTL gating; no real network calls or credentials are involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:269-271